[alsa-devel] [patch] ASoC: rcar: off by one in rsnd_scu_set_route()
If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of the routes[] array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c index 1ab1bce..5e46ef2 100644 --- a/sound/soc/sh/rcar/scu.c +++ b/sound/soc/sh/rcar/scu.c @@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv, return 0; id = rsnd_mod_id(mod); - if (id < 0 || id > ARRAY_SIZE(routes)) + if (id < 0 || id >= ARRAY_SIZE(routes)) return -EIO; /*
Hi
If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of the routes[] array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c index 1ab1bce..5e46ef2 100644 --- a/sound/soc/sh/rcar/scu.c +++ b/sound/soc/sh/rcar/scu.c
Nice catch Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv, return 0;
id = rsnd_mod_id(mod); - if (id < 0 || id > ARRAY_SIZE(routes)) + if (id < 0 || id >= ARRAY_SIZE(routes)) return -EIO;
/* _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
Best regards --- Kuninori Morimoto
On Fri, Nov 08, 2013 at 12:46:10PM +0300, Dan Carpenter wrote:
If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of the routes[] array.
Applied, thanks.
participants (3)
-
Dan Carpenter -
Kuninori Morimoto -
Mark Brown